CVE-2026-58492: Grav Database Plugin SQLi Vulnerability

CVE-2026-58492 Overview

CVE-2026-58492 is a SQL injection vulnerability in grav-plugin-database, the database plugin for Grav CMS. The PDO::tableExists method interpolates its table argument directly into a raw SQL query string. The method performs no sanitization, escaping, quoting, or whitelisting on the input. Attacker-controlled table names passed through consuming plugin or developer code execute arbitrary SQL against the configured database. The flaw is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Version 1.2.0 of the plugin resolves the issue.

Critical Impact
Attackers can execute arbitrary SQL statements against the backing database, leading to full data confidentiality and integrity loss on affected Grav CMS deployments.

Affected Products

Grav CMS grav-plugin-database prior to version 1.2.0
Consuming Grav plugins that pass user-influenced table names to PDO::tableExists
Grav CMS installations relying on the vulnerable database plugin for schema checks

Discovery Timeline

2026-07-10 - CVE-2026-58492 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-58492

Vulnerability Analysis

The vulnerability resides in the PDO::tableExists method of the Grav database plugin. The method accepts a table name argument and concatenates it directly into a raw SQL query string. No parameter binding, identifier quoting, or allow-list validation is applied before the query is dispatched to the database driver.

When a consuming plugin or theme passes a value derived from HTTP input, form fields, or route parameters into tableExists, the attacker controls the SQL string. The plugin exposes the standard PDO surface, so injected payloads can leverage UNION SELECT, stacked queries, or database-specific side effects depending on the driver in use.

Because the vulnerable sink sits inside a reusable plugin API, exploitation depends on how downstream code invokes it. Any code path that forwards untrusted input into tableExists becomes an injection primitive.

Root Cause

The root cause is missing sanitization of a SQL identifier. Table and column names cannot be bound using PDO prepared statement placeholders, so developers must apply strict allow-listing or safe quoting. The pre-1.2.0 implementation does neither, treating the caller-supplied string as trusted.

Attack Vector

Exploitation is network-based and requires no authentication when the consuming plugin exposes the sink through an unauthenticated endpoint. The attacker submits a crafted table-name value that terminates the intended query fragment and appends arbitrary SQL. Successful exploitation yields data extraction, modification, or, on some database engines, command execution primitives.

php

// Security patch excerpt from classes/PDO.php and classes/StatementHelpers.php
// Source: https://github.com/getgrav/grav-plugin-database/commit/f6d058785c9e23df7efc5ea7556f8746fef286df

<?php
namespace Grav\Plugin\Database;

require_once __DIR__ . '/StatementHelpers.php';

class PDO extends \PDO
{
    // The __call wrapper was moved into a shared trait (StatementHelpers)
    // that both the native PDO wrapper and the YetiSQL wrapper reuse.
    // The trait also provides a safe tableExists() implementation that no
    // longer interpolates the table argument into a raw SQL string.
}

trait StatementHelpers
{
    public function __call($func, $args)
    {
        if (!\in_array($func, ['select','selectall','update','delete','insert'])) {
            throw new \RuntimeException($func . ' is not a valid statement');
        }

        if (\count($args) === 2) {
            $stmt = parent::prepare($args[0]);
            $stmt->execute($args[1]);
        } elseif ($args) {
            $stmt = parent::query($args[0]);
        }
    }
}

The patch centralizes query handling in a StatementHelpers trait and replaces the unsafe tableExists implementation with one that no longer concatenates the table argument into a raw SQL query.

Detection Methods for CVE-2026-58492

Indicators of Compromise

Unexpected SQL syntax errors in Grav or PHP logs referencing tableExists call sites
Web server access logs containing SQL metacharacters (', ", ;, --, UNION, SELECT) in parameters routed to database plugin consumers
Database audit logs showing schema introspection queries followed by anomalous UNION or stacked statements from the Grav application user

Detection Strategies

Perform static review of any plugin or custom code invoking PDO::tableExists to identify tainted data flows into the table argument
Deploy web application firewall rules that flag SQL metacharacters in request parameters targeting Grav admin and plugin routes
Enable PDO error logging and alert on syntax errors originating from the database plugin path

Monitoring Recommendations

Monitor Grav plugin directories for the installed version of grav-plugin-database and alert on versions below 1.2.0
Baseline the expected query patterns from the Grav database user and alert on deviations such as information_schema access or unexpected UNION operators
Track outbound database connections and query volumes to detect data exfiltration attempts following injection

How to Mitigate CVE-2026-58492

Immediate Actions Required

Upgrade grav-plugin-database to version 1.2.0 or later, which introduces the StatementHelpers trait and removes the unsafe interpolation
Audit all custom plugins and site code that call tableExists and confirm no untrusted input reaches the method
Rotate database credentials used by the Grav application if any evidence of exploitation is present in logs

Patch Information

The fix is delivered in the GitHub Release Version 1.2.0. The remediation commit is available at the GitHub Commit for Plugin. Additional context is published in the GitHub Security Advisory GHSA-8jxg-4pw9-xcwf.

Workarounds

Restrict access to the Grav admin panel and any plugin endpoints that reach tableExists using network ACLs or authentication proxies until patching completes
Wrap calls to tableExists with an allow-list check that validates the table name against a fixed set of expected identifiers
Grant the Grav database user the minimum privileges required, removing DDL and cross-database access to limit blast radius

bash

# Update the Grav database plugin via the Grav CLI
bin/gpm update database

# Verify the installed version is 1.2.0 or later
bin/gpm info database | grep -i version